CVE-2017-18349
CRITICAL EXPLOITED NUCLEIFastjson Insecure Deserialization - Remote Code Execution
Title source: nucleiExploitation Summary
CVE-2017-18349 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 2 public exploits from researchers including h0cksr, Dungsocool. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a proof-of-concept exploit for CVE-2017-18349, a Fastjson deserialization vulnerability. It demonstrates remote code execution by leveraging JNDI injection via a malicious RMI server to execute arbitrary commands (e.g., touching a file).
Description
parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.
Exploits (2)
This repository contains a proof-of-concept exploit for CVE-2017-18349, a Fastjson deserialization vulnerability. It demonstrates remote code execution by leveraging JNDI injection via a malicious RMI server to execute arbitrary commands (e.g., touching a file).
This repository provides a detailed technical analysis of CVE-2017-18349, focusing on the exploitation of Fastjson 1.2.24 via deserialization and JNDI injection. It includes step-by-step fingerprinting, version verification, and exploitation methodology but does not contain functional exploit code.
Nuclei Templates (1)
References (3)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H